LLVMFuzzerTestOneInput:
   35|     75|extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   36|     75|    if (size < 2) return 0;
  ------------------
  |  Branch (36:9): [True: 1, False: 74]
  ------------------
   37|       |
   38|     74|    const uint8_t* payload = data;
   39|     74|    size_t payload_len = size;
   40|       |
   41|     74|    if (!validate_nsm_msg_length(payload, payload_len)) {
  ------------------
  |  Branch (41:9): [True: 3, False: 71]
  ------------------
   42|      3|        return 0;
   43|      3|    }
   44|       |
   45|     71|    const struct nsm_msg* msg = reinterpret_cast<const struct nsm_msg*>(payload);
   46|     71|    const struct nsm_msg_hdr* hdr = reinterpret_cast<const struct nsm_msg_hdr*>(payload);
   47|       |
   48|       |    // Mismatch prevention: verify request/response type
   49|     71|    if (hdr->request != true) {
  ------------------
  |  Branch (49:9): [True: 11, False: 60]
  ------------------
   50|     11|        return 0;
   51|     11|    }
   52|       |
   53|     60|    std::vector<uint8_t> out_buf(65536, 0);
   54|     60|    std::vector<uint8_t> fuzz_histogram_id_buf(65536, 0);
   55|     60|    uint32_t* fuzz_histogram_id = reinterpret_cast<uint32_t*>(fuzz_histogram_id_buf.data());
   56|     60|    std::vector<uint8_t> fuzz_parameter_buf(65536, 0);
   57|     60|    uint16_t* fuzz_parameter = reinterpret_cast<uint16_t*>(fuzz_parameter_buf.data());
   58|     60|    decode_get_histogram_data_req(msg, payload_len, fuzz_histogram_id, fuzz_parameter);
   59|       |
   60|     60|    return 0;
   61|     71|}

_Z23validate_nsm_msg_lengthPKhm:
   27|     74|inline bool validate_nsm_msg_length(const uint8_t* payload, size_t payload_len) {
   28|     74|    return payload_len >= sizeof(struct nsm_msg_hdr);
   29|     74|}

decode_get_histogram_data_req:
 1336|     60|{
 1337|     60|	if (msg == NULL || histogram_id == NULL || parameter == NULL) {
  ------------------
  |  Branch (1337:6): [True: 0, False: 60]
  |  Branch (1337:21): [True: 0, False: 60]
  |  Branch (1337:45): [True: 0, False: 60]
  ------------------
 1338|      0|		return NSM_SW_ERROR_NULL;
 1339|      0|	}
 1340|       |
 1341|     60|	if (msg_len <
  ------------------
  |  Branch (1341:6): [True: 6, False: 54]
  ------------------
 1342|     60|	    sizeof(struct nsm_msg_hdr) + sizeof(nsm_get_histogram_data_req)) {
 1343|      6|		return NSM_SW_ERROR_LENGTH;
 1344|      6|	}
 1345|       |
 1346|     54|	nsm_get_histogram_data_req *request =
 1347|     54|	    (nsm_get_histogram_data_req *)msg->payload;
 1348|       |
 1349|     54|	if (request->hdr.data_size <
  ------------------
  |  Branch (1349:6): [True: 27, False: 27]
  ------------------
 1350|     54|	    sizeof(request->histogram_id) + sizeof(request->parameter)) {
 1351|     27|		return NSM_SW_ERROR_DATA;
 1352|     27|	}
 1353|       |
 1354|     27|	*histogram_id = le32toh(request->histogram_id);
 1355|     27|	*parameter = le16toh(request->parameter);
 1356|       |
 1357|     27|	return NSM_SW_SUCCESS;
 1358|     54|}